Classifications

• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
  • G06F7/58—Random or pseudo-random number generators
  • G06F7/588—Random number generators, i.e. based on natural stochastic processes

Definitions

• the present invention relates generally to the generation of random numbers.
• Random numbers are used in various encryption applications, in particular for the encryption of data exchanged in secure communication systems such as professional radio systems or PMR ("Professional Mobile Radio").
• Data encryption indeed requires random numbers such as, for example, secret identification numbers, encryption keys or initial values for iterative encryption algorithms, or the like.
• a known approach for generating random numbers is to use a linear feedback shift register (LFSR).
• An n-bit LFSR is a pseudo-random number generator that processes a polynomial of degree n.
• a conventional structure includes an LFSR having a 1-bit input value provided by the sampled output of a high-noise phase oscillator whose frequency is much greater than the sampling frequency. This input value is called the entropy bit.
• the LFSR is clocked by a clock signal at the sampling frequency.
• This structure which has the particular advantage of occupying a small area of silicon and therefore be well suited for integrated circuit applications, nevertheless has a disadvantage.
• This disadvantage lies in the fact that the structure generates numbers which, over a long duration, are not totally random, they are correlated with the frequency of the oscillator which is stable because it depends only on the environmental conditions (temperature , voltage ).
• US 6,954,770 discloses a structure in which an entropy value over an N number of bits is provided at the input of the LFSR, where N is an integer greater than unity.
• Each entropy bit is provided by the sampled output of a respective oscillator. It is injected at the input of one of the shift register elements forming the LFSR via a gate "Exclusive OR" type logic further coupled to the output of the previous shift register element.
• This more complex structure indeed increases the randomness of the numbers generated, but it retains the same disadvantage described above, ie the numbers generated are not totally independent, each oscillator having a stable frequency.
• Another disadvantage of this solution is the increase in power dissipated due to a larger number of oscillators operating at high frequency.
• Embodiments of the present invention further enhance the randomness of the numbers generated using an LFSR by reducing the correlation of the numbers generated with the oscillator frequency by using a randomly varying oscillator in phase and frequency. Frequency by exploiting all the random characteristics of materials (temperature, location, ). They make it possible to minimize the power dissipated by limiting the number of oscillators, and / or to conceal the structure that only uses standard logic cells that are embedded in a set of doors.
• a first aspect of the invention thus proposes a random number generator comprising: a linear feedback shift register, or LFSR, with n bits, where n is a determined integer;
• At least one oscillator having at least one delay element introducing a variable delay in its feedback loop, and at least one sampler / blocker having at least one input coupled to an output of the oscillator, and at least one an output coupled to an input of the LFSR, and a clock input receiving a sampling clock signal at a frequency much lower than the frequency of the oscillator.
• This generator is configured to vary the delay introduced by the delay element into the feedback loop of the oscillator as a function of a number q of feedback bits among the n output bits of the LFSR, where q is an integer such that 1 ⁇ q ⁇ n.
• a second aspect of the invention provides a method of generating random numbers using: - a linear feedback shift register, or LFSR, with n bits, where n is a specified integer;
• At least one oscillator having at least one delay element introducing a variable delay in its feedback loop
• At least one sampler having at least one input coupled to an output of the oscillator, and at least one output coupled to an input of the
• the delay introduced in the feedback loop of the oscillator is varied according to a number q of feedback bits among the n output bits of the LFSR, where q is an integer such that 1 ⁇ q ⁇ n.
• the intrinsic structure of the delay element has a highly variable nature depending on the environment by exploiting all the physical variations of the microelectronic structure and the substrate.
• Varying the delay introduced into the oscillator feedback loop according to at least a portion of the output bits of the LFSR creates a random feedback loop, which has the effect of adding a noise in frequency in the oscillator and create a strong instability in the behavior of the LFSR allowing to eliminate the deterministic character of the sequence of numbers delivered by the LFSR.
• FIG. 1 is a diagram of a basic structure of a pseudo random number generator using an LFSR and an oscillator
• FIG. 2 gives chronograms illustrating the operating principle of the basic structure of FIG. 1;
• FIG. 3 is a diagram of a first looped random number generator structure according to first embodiments of the present invention.
• FIG. 4 is a diagram illustrating the principle of an N-input LFSR
• FIG. 5 is a diagram of an exemplary oscillator that can be used in embodiments of the present invention.
• FIG. 6 is a diagram of a two-loop random number generator structure, according to second embodiments of the present invention.
• a pseudo random number generator structure on which embodiments of the present invention are based includes an LFSR and an oscillator with an element introducing a determined delay.
• a conventional structure shown for example in Figure 6 of US 6,480,072 cited and discussed in introduction, comprises a ring oscillator 1 whose output is looped with the input via a delay element 11.
• a ring oscillator is composed of a chain of elements or inverter stages in odd number (greater than unity), closed on itself.
• the delay element 11 is designed such that it introduces a highly variable delay depending on the physical characteristics of the environment, including but not only the temperature of the circuit. It follows that the signal CLK_R delivered by the oscillator is unstable in phase, as being affected by a phase noise. random. This is why we will sometimes speak, in the following, of a random clock signal to designate the signal delivered by the oscillator.
• the output of oscillator 1 is sampled by flip-flop 2 at the frequency of a clock signal CLK stable in phase, the frequency of which is much lower than the frequency of the oscillator. .
• the bit corresponding to the binary value delivered by the flip-flop 2 is provided as a 1-bit entropy bit at the input of an n-bit LFSR 3, which is clocked by the clock signal CLK.
• the output of the LFSR produces n-bit RN random numbers, which change in value at each CLK signal activation edge.
• the accumulated value of the number RN depends on the natural evolution of the value of the polynomial processed by the LFSR at the rhythm of the clock signal CLK, and furthermore values of the entropy value injected at the slower rate of the signal CLK_R.
• the phase noise of the signal CLK_R corresponds to a jitter ("jitter" in English) which results in a certain distribution of the temporal position of the edges of the signal CLK_R.
• the successive values of the signal CLK_R sampled at the frequency of the signal CLK constitute a sequence of binary values randomly equal to 1 or 0.
• a high phase noise oscillator 100 comprises a delay element 110.
• the oscillator may for example be a ring oscillator comprising a number z of stages cascaded, where z is an odd integer.
• the oscillator 100 comprises a number p of separate outputs, corresponding for example each to the output of a respective inverter stage of the oscillator, where p is an integer such that 1 ⁇ p ⁇ n and p ⁇ z. These p outputs deliver a random clock signal CLK_R1 on p bits (in practice, it is actually p parallel signals).
• the signal CLK_R1 is provided at the input of a sampler / blocker 200 which is activated by a phase-stable clock signal CLK1.
• This sampler / blocker comprises for example p flip-flops in parallel, for example flip-flops SR, T, JK, or D, each receiving one of the p bits of the signal CLK_R1, respectively, on its data input.
• the flip-flops of the sampler 200 are all activated by the CLK1 signal. The purpose of this sampler is to synchronize the signal CLK_R1 with the clock signal CLK1.
• the output of the sampler 200 delivers an IN signal on p bits (in practice, it is in fact also here p parallel signals), each corresponding to the output of a respective one of the flip-flops of the sampler 200.
• the signal IN is provided as entropy value on p bits, at the input of a
• the LFSR 300 is activated by the clock signal CLK1. It processes a polynomial of degree n, and outputs a random number RN encoded on n bits.
• a number q of bits form a feedback signal FB1 on q bits, where q is an integer such that 1 ⁇ q ⁇ n.
• the q bits of the signal FB1 called feedback bits, are used to vary the delay introduced by the delay element 110 of the oscillator 100. As can be seen clearly in FIG. 3, a loop is thus created. random feedback between the LFSR 300 and the oscillator 100. With this principle, the entropy value IN introduced at the input of the LFSR has a strong random character, and can generate RN numbers of n bits really random.
• the constituent elements of the structure that are the oscillator 100 and LFSR 300 are looped, each interacting with each other in a random manner, which guarantees a very random overall operation.
• the RN numbers taken at the output of the LFSR 300 at each draw have a strong random and non-dependent character, which makes possible numerous consecutive draws in the applications that require it.
• This principle makes it possible to generate random numbers of good quality, whatever their size n.
• This also makes it possible to use a LFSR of lower degree than with a structure of the prior art, with equal quality of the generated numbers.
• FIG. 4 the principle, known per se, of a LFSR with p inputs and n outputs will now be exposed.
• the LFSR 300 comprises n flip-flops (for example flip-flops D called "Flip-Flop”) respectively FF1 to FFn cascaded with one another ,.
• the output of the last flip-flop FFn is coupled to the input of the first flip-flop FF1 via a logic gate XOR1 of type
• each of the flip-flops FFi is connected to the input of the next flip-flop FFi + 1 either directly or, as shown, via a logic gate XORi + 1, for all i such that 1 ⁇ i ⁇ n - 1
• the output of one flip-flop can be connected to the input of another.
• the output of the flip-flop FFn-1 is thus coupled to the input of the flip-flop FF2 via the gate XOR2.
• the p bits of the entropy value IN are each delivered to the input of a respective one of the flip-flops FF1 to FFn via the corresponding logic gate, respectively XOR1 to XORn.
• the n outputs of the LFSR which deliver the n bits of the random number generated, are taken on the outputs of the n flip-flops FF1 to FFn, respectively.
• any FFi flip-flop does not receive any of the p bits of the entropy value IN and is also not coupled to the output of a flip-flop other than the previous flip-flop FFi-1 , then it can be directly coupled to the latter, that is to say without going through the door
• the oscillator 100 is based on a ring oscillator.
• the oscillator thus comprises a number z of cascaded inverter stages, where z is an odd integer, respectively INV1 to INVz. These inverter elements can be made very simply in CMOS technology.
• the oscillator furthermore comprises a number p of separate outputs each corresponding to the output of a respective inverter, where p is an integer such that 1 ⁇ p ⁇ n and p ⁇ z (it should be remembered that p corresponds to the number of bits encoding the IN entropy values provided at the input of the LFSR). These outputs deliver the p bits forming the signal CLK R1.
• the oscillator preferably comprises at least 2 q different delay elements, and at least one multiplexer configured to select one of the 2 q delay elements as a function of at least a portion of the q feedback bits.
• These delay elements may correspond to delay paths each introducing a respective delay.
• Each delay path comprises one or more logical elements having different characteristics (size, composition, ...) in order to ensure a different delay for each of them as well as a different behavior with respect to the physical phenomena leading to a different behavior. different variation of this delay affecting them (location on the semiconductor substrate, voltage, temperature, ..) thus causing a different phase noise behavior for the 2 q delays
• an embodiment of the oscillator preferably comprises a number m of multiplexers, where m is an integer such that 1 ⁇ m ⁇ z, each disposed upstream of one of the z stages inverters INV1 to INVz.
• These multiplexers MUX1 to MUXm are each configured to select one of the 2 q delay elements as a function of at least a portion of the q bits of feedback. This gives the application of a variable delay in m different locations of the oscillator, which multiplies the possible configurations, and thus contributes to increase the randomness of the logic states of the signal CLK_R1 delivered by the oscillator.
• the m multiplexers are configured to each select one of a number 2 lk of the 2 q delay elements as a function of a number I k of bits among the q feedback bits, where I k is an integer such that 1 ⁇ l k ⁇ q for all k such that 1 ⁇ k ⁇ m.
• the 2 q delay elements are distributed between the mux multiplexer MUX1 to MUXm, which amounts to reducing the total number of delay elements to be predicted with respect to a structure in which each multiplexer would make it possible to select one of 2 q delay elements (so that in fact mx2 q delay elements in total would be needed).
• the 2 lk delay elements associated with each multiplexer MUXk are referenced DELk, 1 to DELk, 2 lk , respectively, for all k such that 1 ⁇ k ⁇ m.
• the bits I k which serve to select the delay element applied by the multiplexer MUXk are obtained from the q bits of feedback via a logic function respectively Sk.
• the logic functions S1 to Sm can for example be implemented in wired combinational logic.
• l k q / m for any k such that 1 ⁇ k ⁇ m.
• the 2 q delay elements are equitably distributed between the m multiplexers MUX1 to MUXm. This simplifies circuit design by allowing the use of masks with repetitive patterns for fabrication on the semiconductor substrate.
• each inverter stage of the ring oscillator is coupled to the preceding stage via a variable delay element as a function of all or part of q bits of feedback.
• Other embodiments of the oscillator are of course conceivable. It does not have to be a ring oscillator. It is sufficient for the oscillator to comprise an element that can be varied according to the q feedback bits to randomly influence the jitter (phase noise) of the signal generated by the oscillator. Similarly, one can have more than one oscillator to generate the p bits forming the entropy value injected into the LFSR.
• the oscillator 100 may be replaced by a number p of separate oscillators each having a respective output, where p is an integer such that 1 ⁇ p ⁇ n, providing one of the bits of the entropy value IN .
• Each of the p oscillators may for example be a ring oscillator which comprises a number z1 of cascade stages, where z ⁇ is a given integer, at least 2 q different delay elements, where q is an integer such that 1 ⁇ q s ⁇ q, and at least one multiplexer configured to select one of the 2 q 'delay elements according to at least a portion of said q-, feedback bits, where i is an index such that 1 ⁇ i ⁇ p making it possible to distinguish between them the p oscillators.
• Such an oscillator would have the same structure as the oscillator shown in FIG. 5 already described (on which the index i would be added to the letters q, z and m), but would have only one output corresponding for example to the output of the last inverter element INVZJ.
• This oscillator is not described in detail again here, but can be declined according to the same embodiments as that of Figure 5, which allows to obtain the corresponding advantages that have been indicated above.
• each ring oscillator may comprise a number mi of multiplexers, where rrij is an integer such that 1 ⁇ m, ⁇ Z 1 for all i such that 1 ⁇ i ⁇ p, each configured to select one of the two q ⁇ delay elements according to at least a part of q ⁇ bits of feedback.
• the multiplexers, for 1 ⁇ n ⁇ ⁇ z, can each be configured to select each one from a number 2 j
• J 1 q / nrii for all i such that 1 ⁇ i ⁇ p.
• the generator here comprises, in addition to the oscillator 100, an additional oscillator 200 (OSC2) having at least one delay element 410.
• OSC2 additional oscillator 200
• 410 introduces a determined delay, which varies according to a number w of feedback bits among the n output bits of the LFSR, where w is an integer such that 1 ⁇ w ⁇ n.
• These w feedback bits form a feedback signal FB2. They may or may not, in whole or in part, be the same as the q feedback bits forming the feedback signal FB1 supplied to the oscillator 100.
• the oscillator 400 may be of the same kind and be made in the same manner as the oscillator 100 described above with reference to the diagram of FIG. 3.
• the oscillator 400 may be a ring oscillator which has the characteristics of the ring oscillator 100 described above.
• the reader is thus referred to this description, in which it is simply necessary to replace the letter q by the letter w (that is to say that the q bits of FB1 must be replaced by the w bits of FB2).
• the signal CLK_R2 delivered by the oscillator 400 is a random clock signal in the sense mentioned above. It is used in place of the signal CLK1 of FIG. 3, to clock the sampler 200 and the LFSR 300.
• the signal CLK_R2 serves as a sampling clock signal of the signal CLK_R1 delivered by the oscillator 100. Since the oscillator 400 is looped with the LFSR 300, the signal CLK_R2 has a very random jitter. This randomness in phase and in frequency of which the signal signal CLK_R2, which itself is affected by a highly random phase noise, is very strongly reinforces the randomness of the entropy values IN injected as input. from the LFSR to the rhythm of the CLK_R2 signal. As can easily be seen, the generator according to these embodiments in fact comprises two noise injection loops, one through the input signal and another through the LFSR clock, while that of FIG. 3 has only one. This makes it possible to increase the quality, that is to say the randomness, of the numbers RN delivered at the output of the LFSR.
• the second loop involves a variation of the operating speed of the LFSR, which results in variations in the temperature of the circuit, which contributes to adding the looping randomness accelerating the parallel phenomena and making the behavior of the circuit unpredictable. structure.
• the numbers RN are preferably synchronized with a clock signal stable in phase.
• the generator may comprise an n-bit sampler / blocker 500, whose n data inputs are coupled to the n outputs of the LFSR 300, whose clock input receives a phase-stable signal CLK2 (as is the signal CLK1 of FIG. 3), and whose n stabilized outputs deliver the n bits of the generated number RN .
• the sampling signal of the first random clock signal CLK_R1 has a selectively stable frequency (as in the case of Figure 3) or unstable (as described above).
• the generator may comprise a multiplexer 600, a first input of which receives the signal CLK1 (phase stable clock signal) of FIG.

Landscapes

• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Engineering & Computer Science (AREA)
• Theoretical Computer Science (AREA)
• Computational Mathematics (AREA)
• Mathematical Analysis (AREA)
• Mathematical Optimization (AREA)
• Pure & Applied Mathematics (AREA)
• General Engineering & Computer Science (AREA)
• Pulse Circuits (AREA)
• Stabilization Of Oscillater, Synchronisation, Frequency Synthesizers (AREA)
• Manipulation Of Pulses (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=37412233

Family Applications (1)

Country Status (4)

Cited By (1)

Families Citing this family (29)

Family Cites Families (15)

• 2006
  • 2006-03-29 FR FR0602728A patent/FR2899352B1/fr active Active
• 2007
  • 2007-03-26 WO PCT/FR2007/000519 patent/WO2007110506A1/fr active Application Filing
  • 2007-03-26 US US12/280,767 patent/US8209367B2/en active Active
  • 2007-03-26 EP EP07731202A patent/EP1999569A1/de not_active Withdrawn

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events